mcpField
H
headless-ghidra-intake

headless-ghidra-intake

github.com/bytelandtechnologySecurity590 installsUpdated 25w ago
Repository

About headless-ghidra-intake

An intake workflow skill that prepares a binary or archive as a target for a headless Ghidra pipeline. It initializes the workspace, discovers Ghidra, inspects the binary, and records the analysis scope without running Ghidra analysis.

Key features

  1. 01Initialize a target workspace
  2. 02Discover Ghidra and inspect binaries
  3. 03Set and review analysis scope
  4. 04Record intake and pipeline state
  5. 05Check the P0 phase gate

Use cases

  1. 01Preparing a binary for a Ghidra workflow
  2. 02Setting function or whole-target scope
  3. 03Reviewing target and environment readiness
  4. 04Recording initial analysis inputs

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/bytelandtechnology/headless-ghidra --skill headless-ghidra-intake

After installing, type/headless-ghidra-intakein Claude Code to confirm it loaded.

Bundled files

References and scripts installed along with SKILL.md.

planning-brief.md
README.ja-JP.md
README.md
README.zh-CN.md
examples/
intake-speckit-handoff.md

Details

From the project README

Headless Ghidra Intake — P0

P0 prepares a target for the rest of the workflow. It is responsible for turning an input binary or archive path into a valid ghidra-agent-cli workspace target and recording the initial analysis scope.

Required ghidra-agent-cli Commands

  • ghidra-agent-cli workspace init
  • ghidra-agent-cli ghidra discover
  • ghidra-agent-cli inspect binary
  • ghidra-agent-cli scope show
  • ghidra-agent-cli scope set
  • ghidra-agent-cli scope add-entry
  • ghidra-agent-cli scope remove-entry
  • ghidra-agent-cli gate check --phase P0

Archive normalization and any target-specific bootstrap scripts may still run as backend details until the CLI exposes them directly.

Inputs

  • User-provided binary or archive path
  • Workspace root
  • Local environment needed for Ghidra discovery

Outputs

  • targets/<target-id>/ghidra-projects/
  • artifacts/<target-id>/pipeline-state.yaml
  • artifacts/<target-id>/scope.yaml
  • Optional phase-owned intake records under artifacts/<target-id>/intake/

Exit Expectations

  • Target workspace exists and is addressable through --target <id>.
  • pipeline-state.yaml records the selected binary path.
  • scope.yaml records the selected functions, addresses, symbols, or explicit whole-target scope.
  • Ghidra discovery and binary inspection have been run and reviewed.

Constraints

  • Do not run actual Ghidra analysis in this phase.
  • Do not write baseline, evidence, decompilation, or verification outputs.
  • Do not bypass ghidra-agent-cli workspace init, ghidra discover, or inspect binary for supported steps.
  • Do not create or run a new Ghidra script if the CLI lacks a capability; pause and ask the user first.

Next Step

  • P0 gate passes → headless-ghidra-baseline

Comments

Markdown supported